https://www.linkedin.com/pulse/gcp-projects-service-accounts-billing-q-chapter-3-uhfkc
Central Node: GCP Projects, Service Accounts, and Billing
1. Projects
Definition: Logical containers for resources
Attributes:Project IDProject NameProject Number
Roles:OwnerEditorViewer
Hierarchy:OrganizationFolderProjects
Policies:IAM PoliciesResource Quotas
2. Service Accounts
Definition: Special Google accounts used by applications
Types:User-managed service accountsGoogle-managed service accounts
Permissions:IAM RolesCustom Roles
Authentication:Encrypted keysOAuth 2.0 Tokens
Use Cases:Running VM instancesAccessing APIsRunning Cloud Functions
Management:CreatingDeletingManaging keys
3. Billing
Definition: Management of costs and payments for GCP services
Accounts:Billing AccountBilling Subaccounts
Types of Billing:Self-service billingInvoiced billing
Tools:Cost Management ToolsBilling ReportsBudgets and Alerts
Payment Methods:Credit CardsBank AccountsInvoicing
Billing Roles:Billing Account AdministratorBilling Account UserBilling Account Viewer
Visual Layout
To visualize this mind map:
Central Node: "GCP Projects, Service Accounts, and Billing" at the center.
Primary Branches:
Sub-branches for Projects:
Sub-branches for Service Accounts:
Sub-branches for Billing:
Here are the GCP Exam questions along with their answers, correct answers, and explanations:
1. Question: You are designing cloud applications for a healthcare provider. The records management application will manage medical information for patients. Access to this data is limited to a small number of employees. The billing department application will have insurance and payment information. Another group of employees will have access billing information. In addition, the billing system will have two components: a private insurance billing system and a government payer billing system. Government regulations require that software used to bill the government must be isolated from other software systems. Which of the following resource hierarchies would meet these requirements and provide the most flexibility to adapt to changing requirements?
- Answer Choices:
- A. One organization, with folders for records management and billing. The billing folder would have private insurer and government payer folders within it. Common constraints would be specified in organization-level policies. Other policies would be defined at the appropriate folder.
- B. One folder for records management, one for billing, and no organization. Policies defined at the folder level.
- C. One organization, with folders for records management, private insurer, and government payer below the organization. All constraints would be specified in organization-level policies. All folders would have the same policy constraints.
- D. None of the above.
- Correct Answer: A
- Explanation: Option A provides a clear hierarchy with flexibility to define policies at different levels (organization, folder). This allows for isolation as required by regulations and adapts easily to changes in requirements.
2. Question: When you create a hierarchy, you can have more than one of which structure?
- Answer Choices:
- A. Organization only
- B. Folder only
- C. Folder and project
- D. Project only
- Correct Answer: C
- Explanation: In GCP, you can have multiple folders and projects within an organization, allowing you to organize resources in a flexible manner.
3. Question: You are designing an application that uses a series of services to transform data from its original form into a format suitable for use in a data warehouse. Your transformation application will write to the message queue as it processes each input file. You don’t want to give users permission to write to the message queue. You could allow the application to write to the message queue by using which of the following?
- Answer Choices:
- A. Billing account
- B. Service account
- C. Messaging account
- D. Folder
- Correct Answer: B
- Explanation: Service accounts can be used to grant specific permissions to applications without giving users those permissions.
4. Question: Your company has a number of policies that need to be enforced for all projects. You decide to apply policies to the resource hierarchy. Not long after you apply the policies, an engineer finds that an application that had worked prior to implementing policies is no longer working. The engineer would like you to create an exception for the application. How can you override a policy inherited from another entity in the resource hierarchy?
- Answer Choices:
- A. Inherited policies can be overridden by defining a policy at a folder or project level.
- B. Inherited policies cannot be overridden.
- C. Policies can be overridden by linking them to service accounts.
- D. Policies can be overridden by linking them to billing accounts.
- Correct Answer: A
- Explanation: Policies defined at a lower level in the hierarchy (folder or project) can override inherited policies.
5. Question: Constraints are used in resource hierarchy policies. Which of the following are types of constraints allowed?
- Answer Choices:
- A. Allow a specific set of values
- B. Deny a specific set of values
- C. Deny a value and all its child values
- D. Allow all allowed values
- E. All of the above
- Correct Answer: E
- Explanation: Constraints can be used to allow specific values, deny specific values, deny values and their children, and allow all allowed values.
6. Question: A team with four members needs you to set up a project that needs only general permissions for all resources. You are granting each person a primitive role for different levels of access, depending on their responsibilities in the project. Which of the following are not included as primitive roles in Google Cloud Platform?
- Answer Choices:
- A. Owner
- B. Publisher
- C. Editor
- D. Viewer
- Correct Answer: B
- Explanation: Google Cloud Platform primitive roles include Owner, Editor, and Viewer. Publisher is not a primitive role.
7. Question: You are deploying a new custom application and want to delegate some administration tasks to DevOps engineers. They do not need all the privileges of a full application administrator, but they do need a subset of those privileges. What kind of role should you use to grant those privileges?
- Answer Choices:
- A. Primitive
- B. Predefined
- C. Advanced
- D. Custom
- Correct Answer: D
- Explanation: Custom roles can be created to grant a specific subset of privileges tailored to the needs of the DevOps engineers.
8. Question: An app for a finance company needs access to a database and a Cloud Storage bucket. There is no predefined role that grants all the needed permissions without granting some permissions that are not needed. You decide to create a custom role. When defining custom roles, you should follow which of the following principles?
- Answer Choices:
- A. Rotation of duties
- B. Least principle
- C. Defense in depth
- D. Least privilege
- Correct Answer: D
- Explanation: The principle of least privilege should be followed to grant only the permissions necessary for the app to function.
9. Question: How many organizations can you create in a resource hierarchy?
- Answer Choices:
- A. 1
- B. 2
- C. 3
- D. Unlimited
- Correct Answer: A
- Explanation: Each GCP account can have only one organization resource.
10. Question: You are contacted by the finance department of your company for advice on how to automate payments for GCP services. What kind of account would you recommend setting up?
- Answer Choices:
- A. Service account
- B. Billing account
- C. Resource account
- D. Credit account
- Correct Answer: B
- Explanation: A billing account is used to manage payments and automate billing for GCP services.
11. Question: You are experimenting with GCP for your company. You do not have permission to incur costs. How can you experiment with GCP without incurring charges?
- Answer Choices:
- A. You can’t; all services incur charges.
- B. You can use a personal credit card to pay for charges.
- C. You can use only free services in GCP.
- D. You can use only serverless products, which are free to use.
- Correct Answer: C
- Explanation: GCP offers a range of free services that can be used without incurring charges.
12. Question: Your DevOps team has decided to use Stackdriver monitoring and logging. You have been asked to set up Stackdriver workspaces. When you set up a Stackdriver workspace, what kind of resource is it associated with?
- Answer Choices:
- A. A Compute Engine instance only
- B. A Compute Engine instance or Kubernetes Engine cluster only
- C. A Compute Engine instance, Kubernetes Engine cluster, or App Engine app
- D. A project
- Correct Answer: D
- Explanation: Stackdriver workspaces are associated with a GCP project.
13. Question: A large enterprise is planning to use GCP across a number of subdivisions. Each subdivision is managed independently and has its own budget. Most subdivisions plan to spend tens of thousands of dollars per month. How would you recommend they set up their billing account(s)?
- Answer Choices:
- A. Use a single self-service billing account.
- B. Use multiple self-service billing accounts.
- C. Use a single invoiced billing account.
- D. Use multiple invoiced billing accounts.
- Correct Answer: D
- Explanation: Using multiple invoiced billing accounts allows each subdivision to manage its own budget independently.
14. Question: An application administrator is responsible for managing all resources in a project. She wants to delegate responsibility for several service accounts to another administrator. If additional service accounts are created, the other administrator should manage those as well. What is the best way to delegate privileges needed to manage the service accounts?
- Answer Choices:
- A. Grant iam.serviceAccountUser to the administrator at the project level.
- B. Grant iam.serviceAccountUser to the administrator at the service account level.
- C. Grant iam.serviceProjectAccountUser to the administrator at the project level.
- D. Grant iam.serviceProjectAccountUser to the administrator at the service account level.
- Correct Answer: A
- Explanation: Granting iam.serviceAccountUser at the project level ensures the administrator can manage
all service accounts in the project, including any new ones that are created.
15. Question: You work for a retailer with a large number of brick and mortar stores. Every night the stores upload daily sales data. You have been tasked with creating a service that verifies the uploads every night. You decide to use a service account. Your manager questions the security of your proposed solution, particularly about authenticating the service account. You explain the authentication mechanism used by service accounts. What authentication mechanism is used?
- Answer Choices:
- A. Username and password
- B. Two-factor authentication
- C. Encrypted keys
- D. Biometrics
- Correct Answer: C
- Explanation: Service accounts use encrypted keys for authentication to ensure secure access to resources.
16. Question: What objects in GCP are sometimes treated as resources and sometimes as identities?
- Answer Choices:
- A. Billing accounts
- B. Service accounts
- C. Projects
- D. Roles
- Correct Answer: B
- Explanation: Service accounts can be used as identities to grant permissions and as resources to be managed.
17. Question: You plan to develop a web application using products from the GCP that already include established roles for managing permissions such as read-only access or the ability to delete old versions. Which of the following roles offers these capabilities?
- Answer Choices:
- A. Primitive roles
- B. Predefined roles
- C. Custom roles
- D. Application roles
- Correct Answer: B
- Explanation: Predefined roles in GCP provide specific permissions tailored for common use cases.
18. Question: You are reviewing a new GCP account created for use by the finance department. An auditor has questions about who can create projects by default. You explain who has privileges to create projects by default. Who is included?
- Answer Choices:
- A. Only project administrators
- B. All users
- C. Only users without the role resourcemanager.projects.create
- D. Only billing account users
- Correct Answer: B
- Explanation: By default, all users in an organization can create projects unless restricted by specific policies.
19. Question: How many projects can be created in an account?
- Answer Choices:
- A. 10
- B. 25
- C. There is no limit.
- D. Each account has a limit determined by Google.
- Correct Answer: D
- Explanation: Google sets a quota limit on the number of projects an account can create, which can vary and be adjusted based on usage.
20. Question: You are planning how to grant privileges to users of your company’s GCP account. You need to document what each user will be able to do. Auditors are most concerned about a role called Organization IAM roles. You explain that users with that role can perform a number of tasks, which include all of the following except which one?
- Answer Choices:
- A. Defining the structure of the resource hierarchy
- B. Determining what privileges a user should be assigned
- C. Defining IAM policies over the resource hierarchy
- D. Delegating other management roles to other users
- Correct Answer: B
- Explanation: Organization IAM roles allow users to manage the resource hierarchy and IAM policies but do not specifically determine what privileges individual users should have; this is typically done at the project level.
